Technical Tip: FortiSIEM compatibility with Octet Counting in FortiMail Syslog over TCP

[pchee]

Description	This article describes how FortiSIEM could correctly parse syslog messages from FortiMail using TCP.
Scope	FortiMail v7.6.x.
Solution	For the syslog, to correctly parse messages from FortiMail between CR LF (Windows), LF(Unix), and CR (Macintosh) line breaks, the following configuration is required: Navigate to Log & Report -> Log Setting -> Remote. Select the button '+ New'. Fill up the Name and Server name/IP. Protocol -> Syslog. Mode-> TCP (Legacy). With this setting, FortiMail will include Non-Transparent-Framing (LF-terminated messages) to parse syslog messages.